Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Signatures
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Snort-sigs] Emerging Threats Daily Signature Changes

from [Jason] Network Security [Permanent Link]
Subject: Re: [Snort-sigs] Emerging Threats Daily Signature Changes
Date: Sun, 30 Dec 2007 22:46:37 -0500 
resending from a subscribed address.

Jason Brvenik wrote:


Matt Jonkman wrote:

Jason wrote:

Why the duplication of snort sigs and emerging sigs I've never really
understood the need. I'd rather see one or the other, no need for two
sigs lists. 

Good point. Historical reasons aside as to why we made a separate list
aside, the only issue I see now would be confusion as to what ruleset
the contributor intended to send their signature. We had an informal
arrangement that anything to the snort-sigs would go to the community
set, and to bleeding/emerging to that ruleset.

The reason we did daily updates to snort-sigs was to let the folks that
didn't care to track the sig devel talk at bleeding/emerging still see
the daily updates.

Certainly no need to send updates to both lists, it is

almost worse in that it eliminates any choice of discussion level /
traffic level...

I agree. Need a good accepted solution for where rules will go if
they're submitted to snort-sigs, or those that are developed during
discussion.

I prefer not to have the duplication as well. But do want to make sure
everyone remains aware of the rules we develop, and gain from any
insights the community in general can offer.

Suggestions/preferences?


Anything submitted on -sigs remains under the GPL if put in the
community set. Regardless, without a license attached to the mail they
can be considered public domain.

I'd still like to see a way by which stable rules get moved into the
permanent snort.org distribution. Is there still a strong unwillingness
to have GPL rules?



Matt


Matt Jonkman wrote:

Which list do you mean?

Was going to just have the commit messages to the emerging-sigs, and the 
daily updates to there and snort-sigs.

If anyone objects I'm happy to do something else.

We could setup the emerging-updates for commit messages as it used to 
be. Anyone prefer that?

Matt

Joel Esler wrote:

Are we going to have emerging threats and bleeding commits on the list  
now?

--
Joel Esler
Sent from the iRoad.

On Dec 30, 2007, at 5:00 PM, emerging@emergingthreats.net wrote:


[***] Results from Oinkmaster started Sun Dec 30 17:00:06 2007 [***]

[+++]          Added rules:          [+++]

2007711 - BLEEDING-EDGE TROJAN Srizbi registering with controller  
(bleeding-virus.rules)
2007712 - BLEEDING-EDGE TROJAN Srizbi requesting template (bleeding- 
virus.rules)


[///]     Modified active rules:     [///]

2406004 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains (1) (bleeding-rbn.rules)
2406005 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains (2) (bleeding-rbn.rules)
2406006 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains (3) (bleeding-rbn.rules)
2406007 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains (4) (bleeding-rbn.rules)
2407004 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains - BLOCKING (1) (bleeding-rbn-BLOCK.rules)
2407005 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains - BLOCKING (2) (bleeding-rbn-BLOCK.rules)
2407006 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains - BLOCKING (3) (bleeding-rbn-BLOCK.rules)
2407007 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains - BLOCKING (4) (bleeding-rbn-BLOCK.rules)


[+++]      Added non-rule lines:     [+++]

    -> Added to bleeding-attack_response.rules (1):
       # $Id: bleeding-attack_response.rules $

    -> Added to bleeding-dos.rules (1):
       # $Id: bleeding-dos.rules $

    -> Added to bleeding-exploit.rules (1):
       # $Id: bleeding-exploit.rules $

    -> Added to bleeding-game.rules (1):
       # $Id: bleeding-game.rules $

    -> Added to bleeding-inappropriate.rules (1):
       # $Id: bleeding-inappropriate.rules $

    -> Added to bleeding-malware.rules (1):
       # $Id: bleeding-malware.rules $

    -> Added to bleeding-p2p.rules (1):
       # $Id: bleeding-p2p.rules $

    -> Added to bleeding-policy.rules (1):
       # $Id: bleeding-policy.rules $

    -> Added to bleeding-rbn-BLOCK.rules (2):
       #  VERSION 21
       #  Updated 2007-12-29 22:48:42

    -> Added to bleeding-rbn.rules (2):
       #  VERSION 21
       #  Updated 2007-12-29 22:48:42

    -> Added to bleeding-scan.rules (1):
       # $Id: bleeding-scan.rules $

    -> Added to bleeding-sid-msg.map (66):
       2007711 || BLEEDING-EDGE TROJAN Srizbi registering with  
controller || url,www.secureworks.com/research/threats/ronpaul/
       2007712 || BLEEDING-EDGE TROJAN Srizbi requesting template ||  
url,www.secureworks.com/research/threats/ronpaul/
       2400000 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound || url,www.spamhaus.org/drop/drop.lasso
       2400001 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound || url,www.spamhaus.org/drop/drop.lasso
       2400002 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound || url,www.spamhaus.org/drop/drop.lasso
       2400003 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound || url,www.spamhaus.org/drop/drop.lasso
       2400004 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound || url,www.spamhaus.org/drop/drop.lasso
       2401000 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound - BLOCKING SOURCE || url,www.spamhaus.org/drop/drop.lasso
       2401001 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound - BLOCKING SOURCE || url,www.spamhaus.org/drop/drop.lasso
       2401002 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound - BLOCKING SOURCE || url,www.spamhaus.org/drop/drop.lasso
       2401003 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound - BLOCKING SOURCE || url,www.spamhaus.org/drop/drop.lasso
       2401004 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound - BLOCKING SOURCE || url,www.spamhaus.org/drop/drop.lasso
       2402000 || BLEEDING-EDGE DROP Dshield Block Listed Source ||  
url,feeds.dshield.org/block.txt
       2403000 || BLEEDING-EDGE DROP Dshield Block Listed Source -  
BLOCKING || url,feeds.dshield.org/block.txt
       2404000 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 1)  || url,www.shadowserver.org
       2404001 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 2)  || url,www.shadowserver.org
       2404002 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 3)  || url,www.shadowserver.org
       2404003 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 4)  || url,www.shadowserver.org
       2404004 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 5)  || url,www.shadowserver.org
       2404005 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 6)  || url,www.shadowserver.org
       2404006 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 7)  || url,www.shadowserver.org
       2404007 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 8)  || url,www.shadowserver.org
       2404008 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 9)  || url,www.shadowserver.org
       2404009 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 10)  || url,www.shadowserver.org
       2404010 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 11)  || url,www.shadowserver.org
       2404011 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 12)  || url,www.shadowserver.org
       2404012 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 13)  || url,www.shadowserver.org
       2404013 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 14)  || url,www.shadowserver.org
       2404014 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 15)  || url,www.shadowserver.org
       2404015 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 16)  || url,www.shadowserver.org
       2404016 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 17)  || url,www.shadowserver.org
       2405000 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405001 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405002 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405003 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405004 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405005 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405006 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 7)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405007 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 8)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405008 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 9)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405009 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
10) - BLOCKING SOURCE || url,www.shadowserver.org
       2405010 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
11) - BLOCKING SOURCE || url,www.shadowserver.org
       2405011 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
12) - BLOCKING SOURCE || url,www.shadowserver.org
       2405012 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
13) - BLOCKING SOURCE || url,www.shadowserver.org
       2405013 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
14) - BLOCKING SOURCE || url,www.shadowserver.org
       2405014 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
15) - BLOCKING SOURCE || url,www.shadowserver.org
       2405015 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
16) - BLOCKING SOURCE || url,www.shadowserver.org
       2405016 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
17) - BLOCKING SOURCE || url,www.shadowserver.org
       2406000 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Hosting Nets || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2406001 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Individual Hosts || url,doc.bleedingthreats.net/bin/view/ 
Main/RussianBusinessNetwork
       2406002 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Chinese Nets || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2406003 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Known Trojan C&Cs || url,doc.bleedingthreats.net/bin/view/ 
Main/RussianBusinessNetwork
       2406004 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains (1) || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2406005 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains (2) || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2406006 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains (3) || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2406007 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains (4) || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2407000 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Hosting Nets - BLOCKING || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2407001 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Individual Hosts - BLOCKING || url,doc.bleedingthreats.net/ 
bin/view/Main/RussianBusinessNetwork
       2407002 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Chinese Nets - BLOCKING || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2407003 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Known Trojan C&Cs - BLOCKING ||  
url,doc.bleedingthreats.net/bin/view/Main/RussianBusinessNetwork
       2407004 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains - BLOCKING (1) || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2407005 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains - BLOCKING (2) || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2407006 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains - BLOCKING (3) || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2407007 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains - BLOCKING (4) || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2500000 || BLEEDING-EDGE COMPROMISED Known Compromised or  
Hostile Host Traffic (1) || url,doc.bleedingthreats.net/bin/view/ 
Main/CompromisedHosts
       2510000 || BLEEDING-EDGE COMPROMISED Known Compromised or  
Hostile Host Traffic - BLOCKING (1) || url,doc.bleedingthreats.net/ 
bin/view/Main/CompromisedHosts

    -> Added to bleeding-virus.rules (2):
       # $Id: bleeding-virus.rules $
       #from Secureworks research

    -> Added to bleeding-voip.rules (1):
       # $Id: bleeding-voip.rules $

    -> Added to bleeding-web.rules (1):
       # $Id: bleeding-web.rules $

    -> Added to bleeding-web_sql_injection.rules (1):
       # $Id: bleeding-web_sql_injection.rules $

    -> Added to bleeding.rules (1):
       # $Id: bleeding.rules $

[---]     Removed non-rule lines:    [---]

    -> Removed from bleeding-rbn-BLOCK.rules (2):
       #  VERSION 8
       #  Updated 2007-11-12 23:25:12

    -> Removed from bleeding-rbn.rules (2):
       #  VERSION 8
       #  Updated 2007-11-12 23:25:12


--- 
----------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs




-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Snort-sigs] Emerging Threats Daily Signature Changes, Matt Jonkman
Next by Date:  Re: [Snort-sigs] Emerging Threats Daily Signature Changes, Lee Clemens
Previous by Thread:  Re: [Snort-sigs] Emerging Threats Daily Signature Changes, Matt Jonkman
Next by Thread:  Re: [Snort-sigs] Emerging Threats Daily Signature Changes, Lee Clemens
Indexes:  [Date] [Thread] [Top] [All Lists]